From 1a7b5adf8484ec0f2b6feb350b578142e186ab26 Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Thu, 2 Jul 2026 23:08:58 +0900
Subject: Move forward proxy from Squid to Caddy (port 80/443)

Replace standalone Squid container with caddy-forwardproxy plugin so the
proxy shares Caddy's existing ports and TLS. HTTP on :80 and HTTPS on :443.
Auth is read from the same vpn/users.conf at Caddy startup via entrypoint.sh.
DNS: add proxy to setup-route53.py WEB_SUBDOMAINS.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 caddy/Caddyfile          |  7 +------
 caddy/Dockerfile         |  9 +++++++++
 caddy/docker-compose.yml |  3 ++-
 caddy/entrypoint.sh      | 35 +++++++++++++++++++++++++++++++++++
 4 files changed, 47 insertions(+), 7 deletions(-)
 create mode 100644 caddy/Dockerfile
 create mode 100644 caddy/entrypoint.sh

(limited to 'caddy')

diff --git a/caddy/Caddyfile b/caddy/Caddyfile
index 5ab87a7..3cf3547 100644
--- a/caddy/Caddyfile
+++ b/caddy/Caddyfile
@@ -41,12 +41,7 @@ blog.yyamashita.com {
     reverse_proxy microblog-app:3000
 }
 
-proxy.yyamashita.com {
-    tls {
-        key_type rsa4096
-    }
-    respond "Proxy Server" 200
-}
+import /tmp/proxy_forward.caddy
 
 vpn.yyamashita.com {
     tls {
diff --git a/caddy/Dockerfile b/caddy/Dockerfile
new file mode 100644
index 0000000..295437b
--- /dev/null
+++ b/caddy/Dockerfile
@@ -0,0 +1,9 @@
+FROM caddy:2-builder-alpine AS builder
+RUN xcaddy build --with github.com/caddyserver/forwardproxy@caddy2
+
+FROM caddy:2-alpine
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
diff --git a/caddy/docker-compose.yml b/caddy/docker-compose.yml
index 3e9385d..e23d25a 100644
--- a/caddy/docker-compose.yml
+++ b/caddy/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   caddy:
-    image: caddy:2-alpine
+    build: .
     ports:
       - "80:80"
       - "443:443"
@@ -9,6 +9,7 @@ services:
       - ./:/etc/caddy/
       - caddy_data:/data
       - caddy_config:/config
+      - /app/infra/vpn/users.conf:/etc/proxy/users.conf:ro
     restart: unless-stopped
     networks:
       - web
diff --git a/caddy/entrypoint.sh b/caddy/entrypoint.sh
new file mode 100644
index 0000000..cf123ce
--- /dev/null
+++ b/caddy/entrypoint.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+set -e
+
+PROXY_CONF=/tmp/proxy_forward.caddy
+
+# Build basicauth lines from shared users.conf
+AUTH_LINES=""
+if [ -f /etc/proxy/users.conf ]; then
+    while IFS=' ' read -r user pass || [ -n "$user" ]; do
+        [ -z "$user" ] && continue
+        case "$user" in \#*) continue ;; esac
+        AUTH_LINES="${AUTH_LINES}        basicauth ${user} ${pass}\n"
+    done < /etc/proxy/users.conf
+fi
+AUTH_BLOCK=$(printf '%b' "$AUTH_LINES")
+
+cat > "$PROXY_CONF" <<EOF
+http://proxy.yyamashita.com {
+    forward_proxy {
+${AUTH_BLOCK}        hide_ip
+        hide_via
+    }
+}
+https://proxy.yyamashita.com {
+    tls {
+        key_type rsa4096
+    }
+    forward_proxy {
+${AUTH_BLOCK}        hide_ip
+        hide_via
+    }
+}
+EOF
+
+exec "$@"
-- 
cgit v1.2.3